Terraform-Associate-003 Practice Exam Questions with Answers HashiCorp Certified: Terraform Associate (003) (HCTA0-003) Certification

This is what you must do to successfully retrieve this value from your networking module, as it will expose the attribute as an output value that can be referenced by other modules or resources. The error message indicates that the networking module does not have an output value named vnet_id, which causes the reference to fail.

Detailed Explanation:

Rationale for Correct Answer (True):Variables without defaults are required inputs. If the calling module doesn’t supply a value, Terraform will fail with an error at plan time.

Analysis of Incorrect Option:

False: Incorrect, because Terraform does not assume defaults when none are provided.

Key Concept:Terraform modules enforce required vs. optional variables depending on whether a default is set.

Infrastructure as code (IaC) is a way of managing and provisioning cloud infrastructure using programming techniques instead of manual processes1. IaC has many advantages over using a graphical user interface (GUI) for provisioning infrastructure, such as:

•Versioning: IaC allows you to store your infrastructure configuration in a version control system, such as Git, and track changes over time. This enables you to roll back to previous versions, compare differences, and collaborate with other developers2.

•Reusability: IaC allows you to create reusable modules and templates that can be applied to different environments, such as development, testing, and production. This reduces duplication, improves consistency, and speeds up deployment3.

•Sharing: IaC allows you to share your infrastructure configuration with other developers, teams, or organizations, and leverage existing code from open source repositories or registries. This fosters best practices, innovation, and standardization4.

•Risk reduction: IaC reduces the risk of human error, configuration drift, and security breaches that can occur when provisioning infrastructure manually or using a GUI. IaC also enables you to perform automated testing, validation, and compliance checks on your infrastructure before deploying it5.

References =

•1: What is Infrastructure as Code? Explained for Beginners - freeCodeCamp.org

•2: The benefits of Infrastructure as Code - Microsoft Community Hub

•3: Infrastructure as Code : Best Practices, Benefits & Examples - Spacelift

•4: 5 Benefits of Infrastructure as Code (IaC) for Modern Businesses in the Cloud

•5: The 7 Biggest Benefits of Infrastructure as Code - DuploCloud

The purpose of state in Terraform is to keep track of the real-world resources managed by Terraform, mapping them to the configuration. The state file contains metadata about these resources, such as resource IDs and other important attributes, which Terraform uses to plan and manage infrastructure changes. The state enables Terraform to know what resources are managed by which configurations and helps in maintaining the desired state of the infrastructure.References = This role of state in Terraform is outlined in Terraform's official documentation, emphasizing its function in mapping configuration to real-world resources and storing vital metadata .

This will trigger a run in the Terraform Cloud workspace, which will perform a plan and apply operation on the infrastructure defined by the Terraform configuration files in the VCS repository.

The -replace flag is used with the terraform apply command when there is a need to explicitly force Terraform to destroy and then recreate a specific resource during the next apply. This can be necessary in situations where a simple update is insufficient or when a resource must be re-provisioned to pick up certain changes.

The required_providers block is used to specify the provider versions that the configuration can work with. The version argument accepts a version constraint string, which must be enclosed in double quotes. The version constraint string can use operators such as >=, ~>, =, etc. to specify the minimum, maximum, or exact version of the provider. For example, version = ">= 3.1" means that theconfiguration can work with any provider version that is 3.1 or higher. References = [Provider Requirements] and [Version Constraints]

Destroy Command Options: Theterraform destroycommand is the correct method to destroy resources, and it requires either manual approval or the -auto-approve flag.

Unsupported Triggering Method: The--destroy flagis not a recognized option for plan or apply commands, making B the correct answer as it isnota valid way to initiate resource destruction.

For more on destroying resources, refer to theterraform destroy command documentationin the Terraform CLI reference.

Referencing Terraform Built-in Functions:

?chomp: removes trailing newlines

?join: combines list into string

?split: splits string into list

?slice:is nota valid Terraform string function (it's used in other languages like Python)

This is the method for sharing Terraform configurations that fulfills the following criteria:

Keeps the configurations confidential within your organization

Supports Terraform’s semantic version constraints

Provides a browsable directory

The Terraform Cloud private registry is a feature of Terraform Cloud that allows you to host and manage your own modules within your organization, and use them in your Terraform configurations with versioning and access control.

Module Versioning: To specify a version in a module block for modules in theTerraform Registry, you add the version attribute, e.g., version = "1.0.0".

Terraform Registry Support: The public registrysupports versioningby enabling semantic constraints, allowing users to define specific versions compatible with their infrastructure requirements.

Refer to themodule versioning documentationin Terraform’s official registry guide.

This is the variable type that you could use for this input, as it can store multiple attributes of different types within a single value. The other options are either invalid or incorrect for this use case.

Detailed Explanation:

Rationale for Correct Answer (A):Providers only interact with one specific platform or API. Terraform itself can work with multiple providers in one configuration, but a single provider is not responsible for provisioning across multiple cloud providers.

Analysis of Incorrect Options:

B. Managing actions to take based on resource differences: This is a provider responsibility (through the resource schema).

C. Managing resources and data sources based on an API: Correct — providers define resources/data sources and map them to API calls.

D. Understanding API interactions with a hosted service: Correct — providers encapsulate API logic to allow Terraform to manage resources.

Key Concept:Providers are API adapters. They handle CRUD operations for resources in their own ecosystem but do not span across multiple cloud platforms.

Terraformis written in Go, but it isdistributed as a standalone binaryanddoes notrequire the Go runtime.

Users do not need to install Go to run Terraform.

Official Terraform Documentation Reference:

Terraform Install Guide

Detailed Explanation:

Rationale for Correct Answer (B):Terraform interacts with external systems through providers. Since this is a new proprietary service with its own API, Terraform does not support it by default. You would need to develop a custom provider that implements Terraform’s provider interface and interacts with the proprietary APIs to manage resources like users.

Analysis of Incorrect Option:

A. Any service hosted on a public cloud provider: Not true. Terraform can only manage services that have providers (official or custom). Just being "hosted on a public cloud" doesn’t guarantee Terraform support.

Key Concept:Terraform providers act as the bridge between Terraform and external APIs. For unsupported services, a custom provider must be developed.

A module cannot always refer to all variables declared in its parent module, as it needs to explicitly declare input variables and assign values to them from the parent module’s arguments. A module cannot access the parent module’s variables directly, unless they are passed as input arguments.

The terraform apply command changes both the cloud infrastructure and the state file after you approve the execution plan. The command creates, updates, or destroys the infrastructure resources to match theconfiguration. It also updates the state file to reflect the new state of the infrastructure. The .terraform directory, the execution plan, and the Terraform code are not changed by the terraform apply command. References = Command: apply and Purpose of Terraform State

It is not a best practice to store secret data in the same version control repository as your Terraform configuration, as it could expose your sensitive information to unauthorized parties or compromise your security. You should use environment variables, vaults, or other mechanisms to store and provide secret data to Terraform.

Terraform modules are referenced by specifying a source location. This location can be a URL or a file path. However, specifying query parameters such as ?version=vl.6.0 directly within the source path is not a valid or supported method for specifying a module version in Terraform. Instead, version constraints are specified using the version argument within the module block, not as part of the source string.References = This clarification is based on Terraform's official documentation regarding module usage, which outlines the correct methods for specifying module sources and versions.

This command will initialize the new backend and prompt you to migrate the existing state file to the new location3. The other commands are not relevant for this task.

Detailed Explanation:

Rationale for Correct Answers:

B. View the execution plan: Correct — terraform plan shows what Terraform intends to do (create, update, or destroy).

C. Save a generated execution plan: Correct — using terraform plan -out=planfile lets you save the plan to apply later with terraform apply planfile.

Analysis of Incorrect Options:

A. Schedule runs in the future: Incorrect, Terraform does not provide scheduling; external tools (like cron, CI/CD) are required.

D. Execute a plan in a different workspace: Incorrect, execution happens in the current workspace; switching workspaces must be done before running the plan.

Key Concept:terraform plan is used for previewing and optionally saving an execution plan for controlled and predictable infrastructure changes.

The key principle of infrastructure as code that is not listed among the options is golden images. Golden images are pre-configured, ready-to-use virtual machine images that contain a specific set of software and configuration. They are often used to create multiple identical instances of the same environment, such as for testing or production. However, golden images are not a principle of infrastructure as code, but rather a technique that can be used with or without infrastructure as code. The other options are all key principles of infrastructure as code, as explained below:

Self-describing infrastructure: This means that the infrastructure is defined in code that describes its desired state, rather than in scripts that describe the steps to create it. This makes the infrastructure easier to understand, maintain, and reproduce.

Idempotence: This means that applying the same infrastructure code multiple times will always result in the same state, regardless of the initial state. This makes the infrastructure consistent and predictable, and avoids errors or conflicts caused by repeated actions.

Versioned infrastructure: This means that the infrastructure code is stored in a version control system, such as Git, that tracks the changes and history of the code. This makes the infrastructure code reusable, auditable, and collaborative, and enables practices such as branching, merging, and rollback. References = [Introduction to Infrastructure as Code with Terraform], [Infrastructure as Code in a Private or Public Cloud]

It lets you version, reuse, and share infrastructure configuration as code files, which can be stored in a source control system and integrated with your CI/CD pipeline.

It reduces risk of operator error by automating repetitive tasks and ensuring consistency across environments. IaC does not necessarily provision resources at a lower cost, secure your credentials, or prevent manual modifications to your resources - these depend on other factors such as your cloud provider, your security practices, and your access policies.

Detailed Explanation:

Rationale for Correct Answer (C):Best practice is to avoid hardcoding sensitive credentials in Terraform configurations or storing them in version control. Instead, credentials should be managed via environment variables, CLI authentication helpers, or secret managers (e.g., Vault).

Analysis of Incorrect Options:

A. Shared server: Not secure, introduces single point of failure and risk.

B. Storing credentials in config files: A major security risk, especially if pushed to version control.

D. None of the above: Incorrect, because option C is a valid and recommended approach.

Key Concept:Security best practices in Terraform dictate that credentials should be externalized from Terraform code.

B (terraform init)–Must be run firstto initialize the Terraform working directory, download providers, and configure the backend.

A (terraform apply)– Requires initialization first, so itcannotbe run before terraform init.

C (terraform plan)– Also requires terraform init first to generate a plan.

D (terraform show)– Displays the state,not relevantfor first-time deployment.

Official Terraform Documentation Reference:

terraform init - HashiCorp Documentation

In Terraform Cloud, speculative plan runs are not automatically started when changes are merged or committed to the version control repository linked to a workspace. Instead, speculative plans are typically triggered as part of proposed changes in merge requests or pull requests to give an indication of what would happen if the changes were applied, without making any real changes to the infrastructure. Actual plan and apply operations in Terraform Cloud workspaces are usually triggered by specific events or configurations defined within the Terraform Cloud workspace settings.References = This behavior is part of how Terraform Cloud integrates with version control systems and is documented in Terraform Cloud's usage guidelines and best practices, especially in the context of VCS-driven workflows.

Terraform is built on a plugin-based architecture, enabling developers to extend Terraform by writing new plugins or compiling modified versions of existing plugins1. Terraform plugins are executable binaries written in Go that expose an implementation for a specific service, such as a cloud resource, SaaS platform, or API2. If there is no existing provider for your API, you can create one using the Terraform Plugin SDK3 or the Terraform Plugin Framework4. References =

•1: Plugin Development - How Terraform Works With Plugins | Terraform | HashiCorp Developer

•2: Lab: Terraform Plug-in Based Architecture - GitHub

•3: Terraform Plugin SDK - Terraform by HashiCorp

•4: HashiCorp Terraform Plugin Framework Now Generally Available

terraform validatechecks for syntax errors and internal consistencyin the configuration files.

However, itdoes notcheck if resource configurations are valid with the provider.

Official Terraform Documentation Reference:

terraform validate - HashiCorp Documentation

Detailed Explanation:

Rationale for Correct Answer (D):The terraform.lock.hcl file is automatically created and maintained by Terraform. It records the specific versions and checksums of providers used in a configuration, ensuring consistent runs across environments and machines.

Analysis of Incorrect Options:

A. There is no such file: Incorrect — the lock file exists and is crucial for dependency management.

B. Storing references to workspaces: Incorrect — workspaces are tracked in the state file, not the lock file.

C. Preventing Terraform runs: Incorrect — the lock file does not block runs; it enforces consistent provider versions.

Key Concept:The terraform.lock.hcl file enforces provider version consistency, which is critical for reproducible and reliable Terraform deployments.

You can install third party plugins using terraform init, as long as you specify the plugin directory in your configuration or as a command-line argument. You can also use the terraform providers mirror command to create a local mirror of providers from any source.

The terraform taint command marks a resource as tainted, which means it will be destroyed and recreated on the next apply. This way, you can replace the VM instance without affecting the database or other resources. References = [Terraform Taint]

Terraform detects infrastructure drift by comparing thestate filewith the actual infrastructure.

When an instance ismanually deleted, Terraformsees it as missingand marks it for recreation.

Running terraform apply willonly recreate the missing instanceswhile leaving the rest of the infrastructure unchanged.

Explanation of incorrect answers:

A (Tear down everything and rebuild)– Incorrect. Terraform does not destroy existing infrastructure unless explicitly told to.

B (Build a completely new set of infrastructure)– Incorrect. Terraform does not create duplicates unless configuration changes.

D (Stop and error out)– Incorrect. Terraform does not fail; itrebuilds missing resourcesautomatically.

Official Terraform Documentation Reference:

Handling Infrastructure Drift

When declaring a Terraform output, the value argument is required. Outputs are a way to extract information from Terraform-managed infrastructure, and the value argument specifies what data will be outputted. While other arguments like description and sensitive can provide additional context or security around the output, value is the only mandatory argument needed to define an output.References = The requirement of the value argument for outputs is specified in Terraform's official documentation, which provides guidelines on defining and using outputs in Terraform configurations.

The terraform plan command does not update the state file. Instead, it reads the current state and the configuration files to determine what changes would be made to bring the real-world infrastructure into the desired state defined in the configuration. The plan operation is a read-only operation and does not modify the state or the infrastructure. It is the terraform apply command that actually applies changes and updates the state file.References = Terraform's official guidelines and documentation clarify the purpose of the terraform plan command, highlighting its role in preparing and showing an execution plan without making any changes to the actual state or infrastructure .

This is the command that lets you experiment with Terraform expressions, by providing an interactive console that allows you to evaluate expressions and see their results. You can use this command to test your expressions before using them in your configuration files.

This is not a valid Terraform variable type. The other options are valid variable types that can store different kinds of values2.

Outside of the required_providers block, Terraform configurations can refer to providers by either their local names or their source addresses. The local name is a short name that can be used throughout the configuration, while the source address is a global identifier for the provider in the format registry.terraform.io/namespace/type. For example, you can use either aws or registry.terraform.io/hashicorp/aws to refer to the AWS provider.

You do not need to use different Terraform commands depending on the cloud provider you use. Terraform commands are consistent across different providers, as they operate on the Terraform configuration files and state files, not on the provider APIs directly.

From Terraform CLI Overview:

"Terraform provides a consistent CLI workflow regardless of which cloud or service you’re managing."

Thesame Terraform commandswork across all providers via plugins.

The two steps that are required to provision new infrastructure in the Terraform workflow are init and apply. The terraform init command initializes a working directory containing Terraform configuration files. It downloads and installs the provider plugins that are needed for the configuration, and prepares the backend for storing the state. The terraform apply command applies the changes required to reach the desired state of the configuration, as described by the resource definitions in the configuration files. It shows a plan of the proposed changes and asks for confirmation before making any changes to the infrastructure. References = [The Core Terraform Workflow], [Initialize a Terraform working directory with init], [Apply Terraform Configuration with apply]

When the state file is locked, operations that modify or depend on the state (liketerraform apply,terraform destroy, andterraform state list) are blocked.terraform fmtonly formats the configuration files and does not interact with the state, so it is allowed.

This is a bad practice, as it exposes your credentials to anyone who can access your configuration files or state files. You should use environment variables, credential files, or other mechanisms to provide credentials to Terraform.

Detailed Explanation:

Rationale for Correct Answer (D):terraform state list shows all resources currently managed by Terraform. terraform state show provides detailed attributes, including the VM ID. This lets you match the Terraform-managed instance with the actual infrastructure.

Analysis of Incorrect Options:

A: Importing is not needed since one VM is already in state.

B: terraform apply doesn’t show which VM ID is managed, it only refreshes attributes.

C: Removing state entries is destructive and may lead to losing state data unnecessarily.

Key Concept:The state file is Terraform’s source of truth for which resources it manages.

Terraform validate reports configuration consistency errors, such as declaring a resource identifier more than once. This means that the same resource type and name combination is used for multiple resource blocks, which is not allowed in Terraform. For example, resource "aws_instance" "example" {...} cannot be used more than once in the same configuration. Terraform validate does not report errors related to module versions, state differences, or formatting issues, as these are not relevant for checking the configuration syntax and structure. References = [Validate Configuration], [Resource Syntax]

Module variable assignments are not inherited from the parent module and you need to explicitly set them using the source argument. This allows you to customize the behavior of each module instance.

Detailed Explanation:

Rationale for Correct Answer (C):Version constraints must be specified with = and quotes, e.g.:

version = ">= 3.1"

This ensures compatibility with Terraform’s syntax.

Analysis of Incorrect Options:

A, B: Incorrect syntax, missing quotes or wrong operator format.

C: Correct Terraform syntax.

Key Concept:Correct syntax in provider version constraints ensures reproducibility.

Detailed Explanation:

Rationale for Correct Answer (D):The Terraform Registry provides documentation for published modules, including:

Required inputs (variables you must supply).

Optional inputs with defaults (so you know what you can override).

Outputs (what values the module returns for use elsewhere).

Therefore, the correct answer is all of the above.

Analysis of Incorrect Options:

A. Required inputs only: Incomplete.

B. Outputs only: Incomplete.

C. Optional inputs only: Incomplete.

D. All of the above: Correct because the Registry provides all relevant documentation.

Key Concept:Terraform Registry modules include inputs, outputs, and usage details, enabling reusability and modular design.

When running a terraform apply -refresh-only, Terraform does not reference the configuration files, but only the state file, credentials, and cloud provider. The purpose of this command is to update the state file with the current status of the real resources, without making any changes to them1.

The best way to specify a tag of v1.0.0 when referencing a module stored in Git is to append ?ref=v1.0.0 argument to the source path. This tells Terraform to use a specific Git reference, such as a branch, tag, or commit, when fetching the module source code. For example, source = "git::https://example.com/vpc.git?ref=v1.0.0 ". This ensures that the module version is consistent and reproducible across different environments. References = [Module Sources], [Module Versions]

Terraform workspaces allow you to create multiple states but still be associated with your current code. Workspaces are like “environments” (e.g. staging, production) for the same configuration. You can use workspaces to spin up a copy of your production deployment for testing purposes without having to configure a new state backend. Terraform data sources, local values, and modules are not features that allow you to create multiple states. References = Workspaces and How to Use Terraform Workspaces

The public Terraform Module Registry automatically exposes all the information about published modules, including required input variables, optional input variables and default values, and outputs. This helps users to understand how to use and configure the modules.

terraform graphgeneratesGraphviz DOT formatoutput, which allows visualization ofresource dependenciesin Terraform.

A (terraform refresh)– Incorrect, as it only updates the state file.

C (terraform output)– Incorrect, as it only displays Terraform output values.

D (terraform show)– Incorrect, as it only displays the Terraform state.

Official Terraform Documentation Reference:

terraform graph - HashiCorp Documentation

These are some of the ways that a ticket-based system can slow down infrastructure provisioning and limit the ability to scale, as they introduce delays, bottlenecks, and manual interventions in the process of creating and modifying infrastructure.

You can configure Terraform to log to a file using the TF_LOG environment variable. This variable can be set to one of the log levels: TRACE, DEBUG, INFO, WARN or ERROR. You can also use the TF_LOG_PATH environment variable to specify a custom log file location. References = : Debugging Terraform

This is what state locking accomplishes, by preventing other users from modifying the state file while a Terraform operation is in progress. This prevents conflicts and data loss.

The terraform state rm commandremovesa resource from Terraform’s state file butdoes not destroythe resource in the actual infrastructure. It only removes Terraform’s knowledge of the resource, meaning Terraform will no longer manage it.

If you run terraform state rm on a resource, Terraform will forget that the resource exists.

However, the resource will still exist in the cloud or infrastructure provider.

If you later run terraform apply, Terraform may try torecreatethe resource because it is no longer present in its state file.

Official Terraform Documentation Reference:

terraform state rm - HashiCorp Documentation

You need to write Terraform configuration files for the existing infrastructure that you want to import into Terraform, otherwise Terraform will not know how to manage it. The configuration files should match the type and name of the resources that you want to import.

You should run terraform init after you start coding a new Terraform project and before you run terraform plan for the first time. This command will initialize the working directory by downloading the required providers and modules, creating the initial state file, and performing other necessary tasks. References = : Initialize a Terraform Project

A (?Correct)– Providers allow Terraform tointeract with APIsof cloud/on-premises services.

B (?Correct)– Some Terraform providers can provisionon-premises infrastructure, such as VMware, OpenStack, etc.

C (?Incorrect)– This describesTerraform Workspaces, not providers.

D (?Correct)– Terraform providers allow provisioning ofpublic cloud resources(AWS, Azure, GCP, etc.).

E (?Incorrect)– Enforcing security and compliance policies isnot a direct provider function, but it can be done using Sentinel or other policy-as-code tools.

Official Terraform Documentation Reference:

Terraform Providers

This is the command that always causes a state file to be updated with changes that might have been made outside of Terraform, as it will only refresh the state file with the current status of the real resources, without making any changes to them or creating a plan.

Not all standard backend types support state locking and remote operations like plan, apply, and destroy. For example, the local backend does not support remote operations and state locking. State locking is a feature that ensures that no two users can make changes to the state file at the same time, which is crucial for preventing race conditions. Remote operations allow running Terraform commands on a remote server, which is supported by some backends like remote or consul, but not all.

 This is a quick way to inspect the state file and find the information you need without modifying anything5. The other options are either incorrect or inefficient.

Detailed Explanation:

Rationale for Correct Answer (True):When terraform apply completes successfully, Terraform prints output values. Outputs from both root and child modules are displayed, but child module outputs must be explicitly exposed through the root module outputs to be visible at the CLI.

Analysis of Incorrect Option:

False: Incorrect, because Terraform does display output values, but only if they are exposed from child modules to the root module.

Key Concept:Outputs help you extract important information (e.g., IP addresses, resource IDs) from your configuration.

The terraform validate command is used to check for syntax errors and internal consistency within Terraform configurations, such as whether all required arguments are specified. It does not check for indentation styles, missing variable values (as variables might not be defined at validation time), or state file consistency with the current infrastructure. Therefore, none of the provided options are correct in the context of what terraform validate reports.References = Terraform's official documentation details the purpose and function of the terraform validate command, specifying that it focuses on syntaxand consistency checks within Terraform configurations themselves, not on external factors like the state file or infrastructure state. Direct references from the HashiCorp Terraform Associate (003) study materials to this specific detail were not found in the provided files.

Setting the TF_LOG environment variable to DEBUG causes debug messages to be logged into stdout, along with other log levels such as TRACE, INFO, WARN, and ERROR. This can be useful for troubleshooting or debugging purposes.

The Terraform collection type that should be used to store key/value pairs is map. A map is a collection of values that are accessed by arbitrary labels, called keys. The keys and values can be of any type, but the keys must be unique within a map. For example, var = { key1 = "value1", key2 = "value2" } is a map with two key/value pairs. Maps are useful for grouping related values together, such as configuration options or metadata. References = [Collection Types], [Map Type Constraints]

The terraform plan command is used to create an execution plan. It allows you to see what actions Terraform will take to reach the desired state defined in your configuration files. It evaluates the current state and configuration, showing a detailed outline of the resources that will be created, updated, or destroyed. This is a critical step in the development process as it helps you verify that the changes you are about to apply will perform as expected, without actually modifying any state or infrastructure.

This is the correct way to reference the volume IDs associated with the ebs_block_device blocks in this configuration, using the splat expression syntax. The other options are either invalid or incomplete.

This is the type of block that is used to construct a collection of nested configuration blocks, by using a for_each argument to iterate over a collection value and generate a nested block for each element. For example, you can use a dynamic block to create multiple ingress rules for a security group resource.

This is the workflow for deploying new infrastructure with Terraform, as it will create a plan and apply it to the target environment. The other options are either incorrect or incomplete.